During the past several decades, electronic computing has evolved from primitive, vacuum-tube-based computer systems, initially developed during the 1940s, to modern electronic computing systems in which large numbers of multi-processor server computers, work stations, and other individual computing systems are networked together with large-capacity data-storage devices and other electronic devices to produce geographically distributed computing systems with hundreds of thousands, millions, or more components that provide enormous computational bandwidths and data-storage capacities. These large, distributed computing systems are made possible by advances in computer networking, distributed operating systems and applications, data-storage appliances, computer hardware, and software technologies. Despite all of these advances, however, the rapid increase in the size and complexity of computing systems has been accompanied by numerous scaling issues and technical challenges, including technical challenges associated with communications overheads encountered in parallelizing computational tasks among multiple processors, component failures, and distributed-system management. As new distributed-computing technologies are developed and as general hardware and software technologies continue to advance, the current trend towards ever-larger and more complex distributed computing systems appears likely to continue well into the future.
In modern computing systems, individual computers, subsystems, and components generally output large volumes of status, informational, and error messages that are collectively referred to, in the current document, as “event messages.” Each event Message corresponds to a specific logging statement in an original source code. However, in large, distributed computing systems, terabytes of event messages may be generated each day. The event messages are often collected into event logs stored as files in data-storage appliances and are often analyzed both in real time, as they are generated and received, as well as retrospectively, after the event messages have been initially processed and stored in event logs. Event messages may contain information that can be used to detect serious failures and operational deficiencies prior to the accumulation of a sufficient number of failures and system-degrading events that lead to data loss and significant down time. The information contained in event messages may also be used to detect and ameliorate various types of security breaches and issues, to intelligently manage and maintain distributed computing systems, and to diagnose many different classes of operational problems, hardware-design deficiencies, and software-design deficiencies. For example, a source code may include numerous different types of log write instruction that are each executed when particular breaches or issues arise during execution of the source code. Ideally, a source code developer or another information technology manager may want to learn the location of the log write instruction that generated a particular event message in order to investigate the surrounding source code for any issues. However, because the source code may have many thousands of different log write instructions, attempts to sift through many thousands if not millions of source code comments, statements, computer instructions in order to locate the particular log write instruction that generated the event message is extremely time consuming and error prone, which may lead to identification of an incorrect log write instruction.